Illicit Residential Proxy Monetization

Attackers are exploiting known vulnerabilities in consumer networking gear (D‑Link, Ubiquiti, Hikvision, Dahua) to install a legitimate bandwidth‑sharing client (Pawns.app) without consent and chain many compromised endpoints into a commercial residential‑proxy service. The campaign (GreyNoise found at least 143 devices across 34 countries) includes persistence techniques (SSH key auth) and leverages the payout mechanics of proxy platforms to monetize stolen bandwidth at scale. — This reveals a new, scalable cybercriminal business model that blurs the line between malware and legitimate apps, raising questions about vendor patching, app provenance, platform liability, and the broader integrity of residential‑IP reputation systems.